HTML Code Hiding

This page has moved to a new location. The version at this location will remain for a time, but will not be updated.

Abstract

A website attempting to hide its HTML becomes inaccessible to 30% of its visitors, loses its ranking in search engines, and only delays crackers by seconds.

How code hiding techniques work

Code hiding techniques come in two parts:

  1. A JavaScript hack tries to prevent users using the right mouse button (combined with frames, this is supposed to prevent the user seeing the source code)
  2. A large section of JavaScript generates the code on the fly from an encrypted version (so even being able to see the source code shouldn't help)

Problems for legitimate users

30% of internet users have JavaScript turned off. Some are paranoid and don't trust any active content. Others are fed up with pop-up windows, and would rather turn off JavaScript then buy a pop-up blocker (or download a decent browser that blocks pop-ups). Some are using devices that don't support JavaScript (for example, mobile 'phones), or using a non-JavaScript browser by choice. Whatever the reason, these visitors cannot access the site.

A 'solution' is to use the <noscript> tag for unencrypted content. However, this can only contain a cut-down version of the page's intended content, otherwise there would be no point in using code-hiding techniques. Page authors will then have to maintain two copies of the information on the page.

Problems for search engines

Search engines have the same problems as non-JavaScript users, and only see the cut-down unencrypted version, leading to lower rankings. Much more seriously, search engines are wary of sites that present the user with different information from that the search engine saw. Search engines are getting better at detecting these 'cloaked' sites and frequently remove them from their indices. By using code-hiding techniques, a site may prevent itself from becoming listed in search engines.

No problems for crackers

Code-hiding techniques only delay crackers by seconds. Any decent browser (for example, Mozilla) will have an option to view generated content, so the hiding techniques have no effect whatsoever. Even if the cracker only has Internet Explorer available, it only takes second to get around code-hiding techniques. As an example, I produced a page on unlocking Weblock Pro in response to Weblock Pro spam sent to the SETI@home message boards.

Further reading

For more information on the use of JavaScript in web pages, and other usability issues, try Jakob Nielsen's excellent book, Designing Web Usability:

This page (http://www.safalra.com/internet/htmlcodehiding.html) was last changed by Safalra (Stephen Morley) at 15:11 (GMT) on 5th December 2003.